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EXAMINER'S ANSWER 



This Supplemental Examiner's Answer is in response to the appeal brief filed 2/10/2006 
appealing from the Office action mailed 6/23/2005. This Supplemental Examiner's 
Answer is identical to the previous Examiner's Answer except for corrections made to 
the "(8) Evidence Relied Upon" section, as requested by the BPAI. 
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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial 
proceedings which will directly affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection 
contained in the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is 
substantially correct. The changes are as follows: 

Issue #2: The Examiner has rejected Claims 1, 2, 5, 11, 15, 16, 19, 25, 29, 30, 
33, 39, and 45-49 under U.S.C. 103(1) as being unpatentable over Welch, Jr. et al., 
U.S. Patent No. 5,862,335, in view of Meadway et al., U.S. Patent No. 6,675,205. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 
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US 5,862,335 



Welch, Jr. et al. 



1-1999 



US 6,675,205 



Meadway et al. 



1-2004 



US 5,991,881 



Conklin et al. 



11-1999 



(9) Grounds of Rejection 



The following ground(s) of rejection are applicable to the appealed claims: 



Claim Rejections - 35 USC §112 



The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 1,15, 29, 45, and 48 are rejected under 35 U.S.C. 112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the 
subject matter which applicant regards as the invention. 

1 . Claims 1,15, and 29 recite the limitation "and operate substantially". It is unclear 
and indefinite to Examiner what this phrase means. The term "substantially" in claims 1 , 
15, and 29 is a relative term that renders the claim indefinite. The term "substantially" is 
not defined by the claim, the specification does not provide a standard for ascertaining 
the requisite degree, and one of ordinary skill in the art would not be reasonably 
apprised of the scope of the invention. The limitation refers to a peer in a peer-to-peer 
network to operate substantially. It is unclear to Examiner as to what degree 
"substantially" is referring. 
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2. Claims 1,15, and 29 recite the limitation "wherein the peer-to-peer network 
permits peers to connect substantially without a server by utilizing the server, at most, 
for providing addresses for the peers in the peer-to-peer network". It is unclear as to 
what is required by the server in this limitation. The limitation recites operating without 
the server, and then the limitation recites, "by utilizing the server". The limitation 
contradicts itself by reciting not using the server to connect and operate 
substantially, and then reciting using the server to connect and operate. 

3. Claim 45 recites the limitation, "wherein a share configuration loop is executed to 
detect changes to shares and corresponding permissions, and take action as a function 
of a type of the changes". It is unclear to Examiner what "take action as a function of a 
type of the changes" means. It is also unclear as to what action is taken. 

Claim Interpretation 

4. Before a detailed rejection, a brief interpretation of peer-to-peer networks should 
be discussed. A peer-to-peer network is a communications network in which each party 
has the same capabilities and either party can initiate a communication session. 

5. Peer-to-peer communication may be implemented in a client/server environment 
by giving each communication node, server and client, the same capabilities, meaning a 
client can be configured as a server and a server can be configured as a client. At any 
given instant during transmission of a file, for instance, one computer is providing the 
file (server) and one computer is receiving the file (client). 
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6. To further support this interpretation, the Gnutella Protocol Specification v0.4 has 
been provided. The Gnutella Protocol Specification shows support that within a peer-to- 
peer network, every client is a server, and vice versa. These so-called Gnutella 
servents perform tasks normally associated with both clients and servers. They provide 
client-side interfaces through which users can issue queries and view search results, 
while at the same time they also accept queries from other servants, check for matches 
against their local data set, and respond with applicable results. Gnutella, being a well 
known peer-to-peer network, shows that a peer-to-peer network is simply comprised of 
clients and servers. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1, 2, 5, 11, 15, 16, 19, 25, 29, 30, 33, 39 and 45-49 are rejected under 35 

U.S.C. 103(a) as being unpatentable over Welch, Jr. et al. (U.S. Patent Number 

5,862,335) in view of Meadway et al. (U.S. Patent Number 6,675,205). 

7. Regarding claims 1,15, and 29, Welch disclosed a computerized method 
comprising: 
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monitoring a peer-to-peer network for suspicious activity based on patterns of 
activity (Welch, col. 2, lines 35-43, Welch disclosed monitoring and analyzing logical 
connections and file transfers between stations within a computer network by 
determining the context of each packet in relationship to earlier packets exchanged 
between two stations. The stations may be user workstations within the computer 
network. User workstations sharing data with each other are also known as peers; col. 
5, lines 55-67 Welch disclosed monitoring the file transfer between peer A and peer B. 
Therefore, Welch disclosed monitoring peers in a peer-to-peer network). 

However, Welch did not explicitly state performing an action associated with a 
particular pattern when the particular pattern is detected in the peer-to-peer network; 
and 

wherein the peer-to-peer network permits peers to connect and operate 
substantially without a server by utilizing the server, at most, for providing addresses for 
the peers in the peer-to-peer network, 

wherein a pattern of activity is defined in terms of a configuration of shared data 
on a peer, the configuration establishing a baseline of authorized shares and 
permissions in association with the shared data; 

wherein monitoring a peer-to-peer network comprises evaluating a change with 
respect to the shared data on a peer in the peer-to-peer network, the change being 
made with respect to the baseline. 

In an analogous art, Meadway disclosed a peer-to-peer system in which a central 
site directs peer systems to each other for file sharing (Meadway, col. 1 , lines 45-52), 
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providing a way for peers to directly transfer the requested file without the need of the 
server (Meadway, col. 1, lines 63-65), with indexing occurring on the peer to monitor the 
changes made to the files that the peer is sharing, with the updates transmitted to the 
central service (Meadway, col. 2, lines 1-10), 

performing an action associated with a particular pattern when the particular 
pattern is detected in the peer-to-peer network (Meadway, col. 4, lines 18-25, Meadway 
disclosed when the central server receives an updated version of the client's index of 
shared data, the central server performs updating the central server's local index); and 

wherein the peer-to-peer network permits peers to connect and operate 
substantially without a server by utilizing the server, at most, for providing addresses for 
the peers in the peer-to-peer network (Meadway, col. 1 , lines 63-65, Meadway 
disclosed providing a way for peers to directly transfer the requested file without the 
need of the server); 

wherein the pattern of activity is defined in terms of a configuration of shared 
data on a peer, the configuration establishing a baseline of authorized shares and 
permissions in association with the shared data (Meadway, col. 2, lines 35-40, col. 4, 
lines 18-25, Meadway disclosed the agent at the client reporting to the central server 
the identities of files on the computer that will be provided if requested by others, and 
when an update occurs to this shared data, the central server is notified, and the central 
server updates its local index, the update to the shared data being authorized by the 
client, and permitted by the client to be shared, the baseline being either the index of 
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the client, or the local index of the central server, since both contain data that is updated 
in association with the shared data of the client). 

wherein monitoring a peer-to-peer network comprises evaluating a change with 
respect to the shared data on a peer in the peer-to-peer network, the change being 
made with respect to the baseline (Meadway, col. 4, lines 18-25, Meadway disclosed 
evaluating a change in the client's index of shared data, and updating the central 
server's local index). 

Welch provides the monitoring of file transfers and logical connections to 
diagnose problems encountered within the network (Welch, col. 1, lines 34-35) in order 
to determine exchange of data as well as which application programs are being used 
(Welch, col. 1 , lines 43-45). 

Meadway provides indexing the identities of files located at each peer in which 
the peer is sharing (Meadway, col. 2, lines 6-10, 35-40). The teachings of Meadway 
enhances the diagnostics of Welch by providing the management system with not only 
exchange of data, but also the contents of the data to be exchanged (Meadway, col. 1 , 
lines 65-67). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to incorporate the teachings of Meadway into Welch to 
provide the management system of Welch with more information regarding the file 
transfers, by providing indexes of the contents of files that peers of the network are 
allowing to be shared (Meadway, col. 2, lines 10-20) in order to provide an enhanced 
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system to diagnose problems (Welch, col. 1, lines 34-35) encountered in the computer 
network. 

Claims 15 and 29 include a computer-readable medium and system performing 
the same functionality as claim 1 . Both Welch and Meadway disclosed a computer- 
readable medium and system (Welch, Fig. 1; Meadway, Fig. 3). Therefore claims 15 
and 29 are rejected under the same rationale. 

8. Regarding claims 2, 16, and 30, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29, including wherein 
monitoring a peer-to-peer network comprises: 

evaluating network traffic among peers in the peer-to-peer network (Welch, col. 
3, lines 25-30). 

9. Regarding claims 5, 19, and 33, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29, including wherein a 
pattern of activity is defined in terms of network traffic in the peer-to-peer network that 
uses a specific protocol (Welch, col. 3, lines 25-30, 45-50). 

10. Regarding claims 11, 25, and 39, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29, including wherein the 
patterns of activity are local to a peer in the peer-to-peer network (Welch, col. 10, lines 
5-10). 
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1 1 . Regarding claim 45, Welch and Meadway disclosed the limitations, substantially 
as claimed, as described in claims 1, 15, and 29, including wherein a share 
configuration loop is executed to detect changes to shares and corresponding 
permissions, and take action as a function of a type of the changes (Meadway, col. 2, 
lines 1-10). 

12. Regarding claim 46, Welch and Meadway disclosed the limitations, substantially 
as claimed, as described in claim 45 including wherein the share configuration loop is 
executed dynamically (Meadway, col. 2, lines 1-10). 

1 3. Regarding claim 47, Welch and Meadway disclosed the limitations, substantially 
as claimed, as described in claim 45 including wherein the share configuration loop is 
executed on a schedule (Meadway, col. 2, lines 1-10). 

14. Regarding claim 48, Welch and Meadway disclosed the limitations, substantially 
as claimed, as described in claim 45 including wherein the share configuration loop 
examines a current share configuration against a previously recorded share 
configuration (Meadway, col. 2, lines 1-10). 

1 5. Regarding claim 49, Welch and Meadway disclosed the limitations, substantially 
as claimed, as described in claim 45 including wherein, if the change includes an 
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attempt to un-share a file or directory the action includes a log entry (Meadway, col. 2, 
lines 1-10, 35-41). 

Claims 4, 7, 9, 10, 12-14,18, 21, 23, 24, 26-28, 32, 35, 37,38, and 40-44 are 
rejected under 35 U.S.C. 103(a) as being unpatentable over Welch, Jr. et al. (U.S. 
Patent Number 5,862,335) in view of Meadway et al. (U.S. Patent Number 6,675,205) 
as applied to claims 1,15, and 29 above, and further in view of Conklin et al. (U.S. 
5,991,881). 

16. Regarding claims 4, 18, and 32, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29. Welch and Meadway did 
not explicitly state wherein a pattern of activity is defined in terms of a threshold value of 
network traffic in the peer-to-peer network. 

In an analogous art, Conklin disclosed a network surveillance system that 
includes checking patterns of activity in comparison to a series of predefined or learned 
patterns which are pre-stored or developed from data received from the network 
(Conklin, col. 4 line 45 through col. 5, Iine10). 

Welch and Meadway together provide a system of monitoring peers and their 
activity in a peer-to-peer network. The teachings of Welch and Meadway suggest peer- 
to-peer networks that communicate using Transmission Control Protocol/Internet 
Protocol (Welch, col. 3, lines 45-67, Meadway, col. 3, lines 20-25). 
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The teachings of Conklin provide a network surveillance designed and intended 
to operate compatibly on networks which communicate using the Transmission Control 
Protocol/Internet Protocol, TCP/IP (Conklin, col. 2, lines 60-67). 

Therefore, it would have been obvious to one in the ordinary skill in the art at the 
time of the invention to incorporate the teachings of Conklin into the teachings of Welch 
and Meadway to identify unauthorized activities such as methods and systems used by 
hackers to intrude into the peer-to-peer network (Conklin, col. 1, lines 10-15). 

17. Regarding claims 7, 21, and 35, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29. Welch and Meadway did 
not explicitly state wherein a pattern of activity is defined in terms of network traffic in 
the peer-to-peer network having a foreign address. In an analogous art, Conklin 
disclosed an intrusion detection function which identifies the network traffic as 
reportable activity when a packet matches a predefined intrusion profile indicating 
source and destination of the packet (Conklin, col. 5, lines 25-35). See motivation 
above. 

18. Regarding claims 9, 23, and 37, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29. Welch and Meadway did 
not explicitly state wherein the action comprises logging information about the particular 
pattern. In an analogous art, Conklin disclosed keeping a log file about the patterns of 
activity (Conklin, col. 5, lines 33-35). See motivation above. 
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19. Regarding claims 10, 24, and 38, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29. Welch and Meadway did 
not explicitly state wherein the action comprises sending an alert about the particular 
pattern. In an analogous art, Conklin disclosed sending out an alert when a pattern is 
detected (Conklin, col. 5, lines 30-33). See motivation above. 

20. Regarding claims 12, 26, and 40, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29. Welch and Meadway did 
not explicitly state wherein the patterns of activity are global to the peer-to-peer network. 
In an analogous art, Conklin disclosed the network surveillance system capturing traffic 
that is broadcast (Conklin, col. 2, lines 50-58). See motivation above. 

21 . Regarding claims 13, 27, and 43, Welch and Meadway disclosed the limitations, 
substantially as claimed, as described in claims 1,15, and 29. Welch and Meadway did 
not explicitly state obtaining a set of rules specifying the patterns of activity and 
associated actions. In an analogous art, Conklin disclosed obtaining pre-stored 
patterns of activity in a database (Conklin, col. 4, lines 45-55). See motivation above. 

22. Regarding claims 14, 28, and 44, Welch, Meadway, and Conklin disclosed the 
limitations, substantially as claimed, as described in claims 13, 27, and 43, including 
refreshing the set of rules when the set of rules changes (Conklin, col. 4, lines 48-52). 
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23. Regarding claim 41 , Welch, Meadway, and Conklin disclosed the limitations, 
substantially as claimed, as described in claim 40, including wherein the system is a 
border firewall (Conklin, col. 4, lines 45-55). 

24. Regarding claim 42, Welch, Meadway, and Conklin disclosed the limitations, 
substantially as claimed, as described in claim 40, including wherein the system is a 
domain name server (Meadway, col. 3, lines 20-25). 

(10) Response to Argument 

The Appellant argues (3) different issues, subcategorized into groups. 

Issue #1: Regarding U.S.C. 1 1 2, 2 nd Rejections of claims 1 , 1 5, 29, 45, and 48. 

Group #1: Claims 1. 15. and 29 

Applicant recites Examiner's position regarding the unclear phrase "and operates 
substantially". Applicant also recites Examiner's position regarding how it is unclear as 
to what is required by the server and that using the server for anything is an option. 
Then, Applicant simply recites the limitation, but fails to provide any arguments against 
Examiner's position. Applicant simply reiterates the limitation of the claim. 

The limitation reads as follows: 



Application/Control Number: 10/028,412 Page 15 

Art Unit: 2143 

"the peer-to-peer network permits peers to connect and operate substantially 
without a server by utilizing the server, at most, for providing addresses for the peers in 
the peer-to-peer network 1 

Examiner submits that the term "substantially" in claims 1,15, and 29 is a relative 
term that renders the claim indefinite. The term "substantially" is not defined by the 
claim, the specification does not provide a standard for ascertaining the requisite 
degree, and one of ordinary skill in the art would not be reasonably apprised of the 
scope of the invention. The limitation refers to a peer in a peer-to-peer network to 
operate substantially. It is unclear to Examiner as to what degree "substantially" is 
referring. 

Examiner submits that the limitation recites operating without the server, and 
then the limitation recites, "by utilizing the server". The limitation contradicts itself by 
reciting not using the server to connect and operate substantially, and then reciting 
using the server to connect and operate substantially. Both parts of the limitation 
do not require any functionality of the server, since the first part explicitly states "without 
a server", and the second part states "utilizing the server, at most , for providing 
addresses". One of ordinary skill in the art would interpret "utilizing the server, at most " 
as not being a requirement. To put it in English, "the peers may use the server to 
provide addresses, but it is not necessary." Therefore, in all aspects of the limitation, 
and disregarding the 1 12 issues, using the server is an option, and not required by the 
claim. 
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Group #2: Claim 45 

Applicant recites Examiner's position regarding the unclear phrase "take action 
as a function of a type of the changes". Then, Applicant simply recites the limitation, 
and further asserts that the actual action taken is not claimed and would unduly limit 
such claim. 

Examiner submits that the phrase "takes action" is unclear as to what is required 
by the claim. It is unclear to Examiner as to what is actually being performed in the 
claim. It is unclear what "taking action" consists of functionally. It is like claiming "A 
method that performs a step" without explaining what "a step" is. 

Group #3: Claim 48 

Applicant asserts that claiming a reason why "the share configuration loop 
examines a current share configuration against a previously recorded shared 
configuration" would unduly limit such claim by limiting the function to a claimed 
purpose. 

Examiner submits that Applicant's argument is persuasive and the rejection has 
been withdrawn. 
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Issue #2 Regarding U.S.C. 1 03(a) Rejection of claims 1,2,5,11,15,16,19,25, 
29, 30, 33, 39, and 45-49 over Welch, Jr. et al. (U.S. Pat. No. 5,862,335) in view of 
Meadway et al. (U.S. Patent No. 6,675,205). 

Group #1: Claims 1. 2. 15. 16. 29. and 30 

Applicant recites Examiner's interpretation that appellant's claimed peer-to-peer 
network to refer to any client and server communications. Applicant disagrees with this 
interpretation. 

Examiner's interpretation is not relative to the rejection over Welch and Meadway 
as both Welch (Welch, col. 5, lines 59-67) and Meadway (Meadway, see Abstract) 
disclose the use of peer-to-peer networks. 

Applicant argues that Meadway does not meet "performing an action associated 
with a particular pattern when the particular pattern is detected". 

Examiner submits that the limitation, in its broadest reasonable interpretation, 
simply discloses, "If something occurs, do something". 

As shown in the above rejection, Meadway disclosed when the central server 
receives an updated version of the client's index of shared data on a scheduled basis 
(Meadway, col. 2, lines 5-7); the central server performs updating the central server's 
local index (Meadway, col. 4, lines 18-25). A particular pattern of activity is the client 
sending updated versions of the client's index on a scheduled basis. 
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After further review of Welch, Examiner also submits that even though it was 
stated that Welch did not explicitly state: 

performing an action associated with a particular pattern when the 

particular pattern is detected in the peer-to-peer network; and 

wherein the peer-to-peer network permits peers to connect and operate 

substantially without a server by utilizing the server, at most, for providing 

addresses for the peers in the peer-to-peer network, 
Welch disclosed if the AME identifies a packet as being part of an existing file transfer, 
the AME updates the appropriate record in the database, the detected pattern being 
that the packet is part of an existing file request 114, and the performed action being 
updating the appropriate record in the database 120 (Welch, col. 6, lines 21-30, Fig. 5, 
114, 120); 

Welch disclosed user workstations able to connect and make available 
application programs to other stations within the network, col. 5, lines 59-63, Welch 
disclosed only peer A and peer B involved in a file transfer, without the use of a server 
(Welch, Fig. 1, col. 2, lines 35-41); 

Therefore, in their broadest reasonable interpretation, Welch in fact does 
disclose these limitations. 
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Applicant argues that Meadway does not disclose, "wherein a pattern of activity 
is defined in terms of a configuration of shared data on a peer" and "evaluating a 
change with respect to the shared data on appear in the peer-to-peer network, the 
change being made with respect to the baseline". 

Examiner submits that Meadway disclosed that the central server receives an 
updated version of the client's index of shared data on a scheduled basis (Meadway, 
col. 2, lines 5-7). As explained above, the pattern of activity is the index of shared data 
at the peer. As disclosed in Meadway, what is reported to the central server are the 
identities of the files on the client's computer that have been authorized for sharing with 
other clients on the network (Meadway, col. 2, lines 35-40). The whole purpose of 
reporting an updated index to the central server is to keep track of which peer is sharing 
which files and to direct requests for certain files to the correct peer (Meadway, col. 1 , 
lines 47-52): One of ordinary skill in the art would interpret peers selecting which files 
they want to share with the network as authorizing or permitting which files are shared 
with other peers on the network. Therefore, the index provides a baseline of authorized 
shares and permissions of files that will be provided if requested by others, and when 
the central server receives an updated index, the central server evaluates a change in 
the authorized shared data and makes updates to the central server's local index. 



Application/Control Number: 10/028,412 Page 20 

Art Unit: 2143 

Group #2: Claims 5. 19. and 33 

Applicant argues that Welch did not disclose "a pattern of activity that is defined 
in terms of network traffic... that uses a specific protocol ." 

Examiner submits that the claim does not explicitly point out which protocol is 
being used, just that a specific protocol is being used. Therefore, any protocol would 
satisfy the limitation. 

Examiner submits that in order for two peers to successfully communicate, they 
must follow the same rules determining the format and transmission of data. Otherwise, 
the peers would not be able to successfully transfer/share files. A protocol is well 
known in the art to be a set of rules describing how to transmit data across a network. It 
is well known in the art that in order for a computer to understand what data is being 
received, the computer must know what protocol is being used to send that data in 
order to follow the rules of the protocol. Therefore, in Welch, the two peers that are 
transmitting files (Welch, col. 5, lines 60-67) must be following a specific protocol in 
order for successful communication. Therefore, monitoring this file transfer would 
require monitoring a specific protocol. 

Group #3 Claims 11. 25. and 39 

Applicant argues that "monitoring local connections and file transfers" do not 
meet applicant's claims "patterns of activity [that] are local to a peer". Applicant does 
not provide any reasoning for this assertion. 
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Examiner submits that by Welch disclosing monitoring file transfers from peer A 
to peer B (Welch, col. 5, lines 58-67) includes monitoring patterns of activity that are 
local to the peer. 

Group #4 Claim 45 

Applicant argues that Meadway did not disclose a "share configuration loop [that] 
is executed to detect changes to shares and corresponding permissions, and take an 
action as a function of a type of the change." 

Examiner submits that the limitation reads, "...take action as a function of a type 
of the change." 

As explained above, Meadway disclosed that when the central server receives 
an updated version of the client's index of shared data on a scheduled basis (Meadway, 
col. 2, lines 5-7), the central server performs updating the changes in the central 
server's local index (Meadway, col. 4, lines 18-25). Therefore, in response to a 
detected change in the client's index, the central server takes action by updating this 
change in the central server's local index. 

Group #5 Claim 46 

Applicant argues that the prior art used in the rejection fails to teach "a share 
configuration loop [that] is executed dynamically." 

Examiner submits that the phrase " executed dynamically" simply means "an 
action that is performed when or as needed while a program is running." 
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One of ordinary skill in the art would interpret the programs running on the central 
server of Meadway to dynamically update the records of its local index when receiving 
an updated index from the client. Examiner would also like to point out that Meadway 
does in fact disclose "dynamic" functionality (Meadway, col. 4, lines 25-30). Therefore, 
it would have been obvious to one of ordinary skill in the art would to interpret any 
functionality of the server to be dynamic. Whenever an agent sends an updated index 
to the central server, the central server updates its local index. This functionality does 
not require a user to update the local index. 

Group #6 Claim 47 

Applicant argues that Meadway did not disclose a "share configuration loop [that] 
is executed on a schedule." 

Examiner submits that Meadway disclosed the indexing process on each system 
may be set on a scheduled basis (Meadway, col. 2, lines 5-10). In programming, a loop 
is simply a process that is constantly performed, waiting for something to happen. In 
the case of Meadway, every time the central server receives an updated index, it 
updates its local index. Every time an updated index is received, the central server 
updates its local index. 
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Group #7 claim 48 

Applicant argues that Meadway does not disclose a "share configuration loop 
[that] examines a current share configuration against a previously recorded shared 
configuration." 

Examiner submits that Meadway disclosed when the central server receives an 
updated version of the client's index of shared data (Meadway, col. 2, lines 5-7); the 
central server performs updating the central server's local index (Meadway, col. 4, lines 
1 8-25). In order for the central server to make the proper changes, the client's updated 
index is examined against the central server's local index (previously recorded share 
configuration). As explained above, the index is a configuration of the shared files that 
the peer permits other peers to request and download. 

Group #8 Claim 49 

Applicant argues that Meadway did not disclose, "if the change includes an 
attempt to un-share a file or directory, the action includes a log entry." 

Examiner submits that this feature is an inherent feature of Meadway since any 
change in the peer's local index, regarding what files are shared or not shared by the 
peer, is included in the updated index that is sent to the central server, and the central 
server updates its local index (Meadway, col. 1 , lines 45-50, col. 2, lines 1-10, 35-40). 
The local index of the central server is a log of the files permitted for sharing by each 
peer. 
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Issue #3 Regarding U.S.C. 103(a) Rejection of claims 4, 7, 9, 10, 12-14, 18, 21, 23, 
24, 26-28, 32, 35, 37, 38, and 40-44 over Welch, Jr. et al. (U.S. Pat. No. 5,862,335) in 
view of Meadway et al. (U.S. Patent No. 6,675,205) and in further view of Conklin et al. 
(U.S. Patent No. 5,991,881). 

Group #1 Claims 4. 10. 12. 18, 24. 26. 32. 38. and 40-42 
Applicant asserts that these claims are not met by the prior art for the reasons 
argued with respect to Issue #1 Group #1 . 

■ Examiner submits that Applicant did not provide any arguments in lssue#1 , 
Group #1 . 

Group #2 Claims 7. 21. and 35 

Applicant argues that Conklin did not disclose a "pattern of activity [that] is 
defined in terms of network traffic in the peer-to-peer network having a foreign address." 

Examiner submits that Conklin does in fact disclose these teachings. Conklin 
disclosed a system for network surveillance and detection of attempted intrusions, or 
intrusions, into the network and into computers connected to the network (Conklin, see 
Abstract). Conklin disclosed identifying the traffic as reportable activity indicating 
source and destination address of the packet (Conklin, col. 5, lines 25-35). Since 
Conklin identifies intrusions into the network from an external source. Conklin disclosed 
reporting patterns of activity that is defined in terms of network traffic having a foreign 
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address. The source of the intrusion has an address outside the network, hence 
foreign. 

Group #3 Claims 9. 23. and 37 

Applicant argues that "the entire triggering packet(s) are written to a log file" in 
Conklin (emphasis added) and not "information about the particular pattern." 

Examiner submits that if the packet is detected as being part of a particular 
pattern, and the entire packets is written to a log file (Conklin, col. 5, lines 33-36), then 
this must contain information regarding the particular pattern, since the packet is what 
caused the detection in the first place. 

Group #4 Claims 13. 27. and 43 

Applicant argues that Conklin fails to disclose, "obtaining a set of rules specifying 
the patterns of activity and associated actions ." 

Examiner submits that the limitation, "associated actions", in its broadest 
reasonable interpretation, could simply mean an action describing the pattern of activity, 
hence the pattern of activity. Applicant may be reading too much into the claim. 
Examiner submits that Conklin disclosed obtaining pre-stored patterns of activity in a 
database (Conklin, col. 4, lines 45-67). One of ordinary skill in the art would interpret 
patterns of activity to include associated actions since a pattern of activity would require 
actions. Otherwise, there would be no pattern of actions. 
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Group #5: Claims 14. 28. and 44 

Applicant argues that Conklin did not disclose "refreshing the set of rules when 
the set of rules changes." 

Examiner submits that Conklin disclosed that Intrusion Detection may incorporate 
algorithms or patterns to detect attempted intrusions or intrusions on the 
network(Conklin, col. 4, lines 45-50), meaning that algorithms may be added to the 
Intrusion Detection system, thereby refreshing sets of rules to follow. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the 
Related Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, 




Jerry B. Dennison 
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